Winning strategies need attention to the business model and the risks inherent in the business model to succeed. Great risk controls take resources to develop, and businesses need to have the discipline to develop the control capability to allow for the possibility to take bigger risks.

Formula One auto racing shows how risk controls are engineered into a winning strategy. Winning requires both engineering cars that reach high speeds with the right driver and investment on controls to manage the risks of high speed. Formula One drivers are allowed to push the car as fast as it can go without crashing due to risk controls. The car, driver and pit crew all play important roles in a strategy to win. What the pit crew needs to do is determined by identified risks and the engineering of the car. However, what the pit crew does is not an afterthought. The car is also engineered with the pit crew’s role in mind to manage risk.

The power of great risk controls can be seen in the Youtube video, below, of a Formula One pit crew in 1950 at the Indianapolis 500 compared with the same scene from 2013 in Melbourne. The car in 1950 coasts into the pit and the crew struggles for 67 seconds to perform the important tasks the race team needs. The 2013 car stops for a brief moment while the crew instantly completes all the work before the car rejoins the race track.

Since the mid-20th century, Formula One pit crews have monitored, measured and improved every detail of a pit stop to shave off time and wasted effort, allowing the team to get the biggest benefit out of each moment at the pit stop. This transformation took time and resources, but the driver could not stay on the track at 200-plus miles per hour speeds and win races without the work of the pit crew.

In business, risk managers, auditors or compliance professionals are the “pit crew” that supports the business’ ambitious strategic goals by managing risks. However, the business does not always perceive these risk managers as playing an important part in strategy. The budgets of risk managers, auditors or the compliance department are cut frequently due to a lack of understanding of the value these roles bring to achieving the strategic goals of the company.

This spring, the unfolding scandals disabling once red-hot startups, shows the folly of innovative business ideas unsupported by adequate investments in compliance and risk controls. The auspicious beginning at Theranos was brought to a halt after a federal report found serious problems with claims the company made about its technology, quality controls, ethics, and compliance. The Silicon Valley unicorn, Zenefits, suffered from a lack of willingness to invest in compliance, sometimes inventing schemes to circumvent the law.

The problems were much deeper than a disorganized office. Insurance brokers must pass a state licensing exam before they can legally sell or advise people on insurance. Each state has a different exam and training requirements. In California, brokers had to spend at least 52 hours on an online training course. Zenefits says Conrad created a Google Chrome browser extension that allowed people to bypass the 52-hour rule by making it appear as if they were working on the course when they weren’t. The extension was called “the macro.”

— Zenefits Was the Perfect Startup. Then It Self-Disrupted, By Claire Suddath and Eric Newcomer, Bloomberg Businessweek, May 9, 2016

Currently, it is unknown whether either company will survive the fallout from recent scandal and law enforcement investigations. Regardless, both Theranos and Zenefits serve as cautionary tales of business strategies derailed by a profound misunderstanding of the value of risk controls to success.